SOC Providers.com Security Operations Center providers
Last reviewed: 3 Oct 2026

Field Effect MDR

Field Effect MDR investigates covered threats and contains them under configured Active Response policies. You retain deployment, response choices, recovery and incident response outside scope.

Platform
Their platform
Price
$5–$25/user/mo range

Who does what

Provider

  • Monitor covered telemetry around the clock
  • Investigate and prioritize actionable findings
  • Contain under configured Active Response policies

Your team

  • Deploy agents and connect telemetry
  • Choose response policies and critical-system exclusions
  • Own recovery and out-of-scope incident response

Coverage

  • Endpoints
  • Cloud Workloads
  • Identity & Access
  • Email
  • Network
  • SaaS Applications

Details

Service scope

Best for MSPs and lean IT teams wanting an MDR platform with policy-bound containment

  • Response policy

    Host isolation, domain blocking, process actions and supported account locking depend on the selected Active Response policy and exclusions.

  • Package coverage

    MDR Endpoint, MDR Core and MDR Complete differ. Network monitoring, expanded cloud apps, retention options and analyst support depend on package.

  • MSP handoff

    Confirm who contacts the customer during incidents and how Field Effect findings map into your PSA and remediation workflow.

Full service analysis

Field Effect MDR is a productized MDR service for SMEs, MSPs and lean IT teams that uses Field Effect's portal, endpoint agent, cloud integrations, network appliance options and 24/7 SOC. After an alert, Field Effect analysts triage and can contain threats through approved response policies, while the buyer or MSP still owns policy choices, recovery work, connected tools and out-of-scope incident response.

Your team owns
  • Choosing the Active Response policy and excluding critical systems where downtime risk matters
  • Deploying endpoint agents, cloud integrations, network appliances and partner PSA workflows
  • Recovering systems, restoring service and handling business decisions after containment
  • Verifying which package covers network, cloud apps, log retention and analyst support
  • Managing incident response work outside the quoted MDR or retainer scope

Why contain threats

Field Effect MDR is classified as Contain threats because official help material documents Active Response actions such as host isolation, malicious-domain blocking, process termination and cloud account locking. The action level still depends on the buyer's selected policy.

Package boundary

Field Effect separates MDR Endpoint, MDR Core and MDR Complete. Core is aimed at smaller endpoint and cloud environments, while Complete adds network monitoring, more cloud-app coverage, longer log-retention options and enhanced analyst support.

MSP buying context

The service is built heavily for MSPs, with partner portal, license-management and PSA integration workflows. MSP buyers should confirm whether Field Effect contacts the end customer directly during urgent response and how ARO ownership maps into their own ticketing process.

Pricing boundary

The current pricing FAQ gives a typical $5–$25 per-user monthly range without tying either end to a fixed package or term. Setup and onboarding are included. An MSP may add deployment, management and support charges. Compare the actual package, currency, commitment and upgrades in the quote.

Pricing & contract

$5–$25/user/mo range

Vendor typical range · currency and term need confirmation · onboarding included

Billing
Per-user, Tiered, Custom
Field Effect pricing FAQ ↗

Tradeoffs & buying questions

Strengths

  • Containment through configured Active Response

    Configured Active Response policies permit containment through supported controls

  • Per-user pricing accommodates multiple devices per user

    Per-user pricing can simplify quoting for MSPs and SMBs with multiple devices per user

  • Endpoint, cloud and network findings in one workflow

    AROs combine vulnerability, endpoint, cloud and network findings in one workflow

  • Configurable response policies and exclusions

    Response policies let buyers choose permitted actions and exclusions

Considerations

  • Network and cloud-app coverage depend on package

    Network and expanded cloud-app coverage require the appropriate package

  • Response policies and exclusions need configuration

    Response permissions and critical-system exclusions need careful configuration

  • Published range is not a fixed package price

    Published prices are a cross-package range rather than a fixed package rate

Ask before buying

  • Which package covers our endpoint, network, Microsoft 365, Google Workspace and other cloud-app telemetry?
  • Which Active Response policy will be enabled after onboarding, and which actions require approval?
  • Are extended log retention, daily dark web monitoring, security awareness training or an incident response retainer included?

Customer feedback

Customers value

  • April and August 2025 PeerSpot users value vulnerability findings and broad monitoring

  • December 2025 MSP accounts praise responsive support and workflow consolidation

Reported concerns

  • An October 2024 PeerSpot user reports a legitimate network scanner being blocked

  • December 2025 MSP accounts describe tuning work and limits on backend data access

Integrations

Endpoint

  • Field Effect Endpoint Agent

Cloud

  • AWS

Other integrations

  • Microsoft 365
  • Google Workspace
  • Microsoft Defender Antivirus management
8 more integrations
  • Autotask
  • ConnectWise PSA
  • HaloPSA
  • Okta
  • Duo
  • Salesforce
  • Dropbox
  • Box

Common questions
Does Field Effect MDR only notify the buyer?No. Configured Active Response policies permit host isolation, domain blocking, process actions and supported cloud-account locking, alongside findings and recommendations.

No. Field Effect MDR sends AROs, but official help material also documents Active Response policies that let Field Effect analysts or automation isolate hosts, block malicious domains, terminate processes or lock supported cloud accounts.

Is Field Effect MDR a full managed SOC?No. It provides active MDR. You or your MSP retain the environment, response policy, recovery and incident response beyond the contracted MDR scope.

No. It is best treated as active MDR. Field Effect supplies a 24/7 SOC-backed MDR platform, but the buyer or MSP still owns the connected environment, response policy, recovery work and incident response beyond the MDR scope.

Is Field Effect MDR pricing public?The official pricing FAQ publishes a typical $5–$25 per user per month range. It does not fix a rate for every package, currency or contract term. Obtain a quote for the selected package, volume, deployment and upgrades, including any MSP-added services.

The official pricing FAQ publishes a typical $5–$25 per user per month range. It does not fix a rate for every package, currency or contract term. Obtain a quote for the selected package, volume, deployment and upgrades, including any MSP-added services.

Company details
Headquarters
Ottawa, Canada
Founded
2016